This LG TV jailbreak turns smart devices into spies, say researchers This LG TV jailbreak turns smart devices into spies, say researchers
The side of the TV required a good bit of zooming in to capture its full thickness.
Kerry Wan/ZDNETZDNET’s key takeaways
- A jailbroken LG TV demonstrates how our devices can become spying tools.
- The TV recorded user data and audio, even on standby.
- Researchers say LG TVs’ “native behavior parallels malware.”
In the UK, we need something called a “TV license” to legally watch live TV. This stealth tax comes in two forms: a license for color TVs and one for black-and-white television sets.
Yes, black and white. Laws haven’t caught up with technology, and it appears that we, as consumers, also need to brush up on just how advanced the technology in our TVs has become.
Also: Is your smart TV a secret proxy? LG to suspend rogue apps, Samsung sets impacted too
TVs have become smarter, with far more functionality than an old black-and-white set; they offer internet connectivity as standard, often include AI features and assistants, and have the potential to become privacy-invading devices able to spy on us and our habits in the right circumstances.
According to a new investigation by YouTube channel Gamers Nexus, in partnership with security researchers from Level1 Techs, LG TVs can be used as “eavesdropping listening devices,” partly due to advertising functionality but also to what appears to be overreaching data collection practices.
The LG TV privacy test
The team bought a new off-the-shelf LG TV to examine. The team then hacked into the TV, using software vulnerabilities to jailbreak it, including a Remote Code Execution (RCE) flaw, and explored what data could be collected, stored, and potentially exfiltrated by attackers.
The LG TV included in the test was able to collect and store an IP address, geographic location, an advertising ID, and the names of Wi-Fi networks in the immediate area — including neighboring Wi-Fi networks in range — alongside other devices on a network, even if they were not connected to the TV.
Also: How to disable ACR on your TV (and why it makes such a big difference when you do)
The team was able to exfiltrate plain-text transcripts of voice conversations and force LG TVs to capture audio via an embedded microphone while the TV appeared to be turned off and in standby. More concerningly, even if the TV was not connected to a network, it was possible to exfiltrate captured content once the TV reconnected to the network.
Some of the data collection practices listed in the report are also down to Automatic Content Recognition (ACR), an ad-tracking engine that silently monitors your screen, allowing advertisers and marketers to create user profiles for targeted advertising purposes. ACR can be found in most smart TVs, and LG’s models are no exception.
The takeaway
This investigation shows that LG TVs, and probably TVs from other brands, might be collecting and storing data that you don’t expect — and would not want stored or shared.
The team said the LG TV’s “native behavior parallels malware,” a statement you could apply to broad data collection and the capability to spy on individuals, but it may be that a lack of awareness is the real problem. It’s highly unlikely someone is going to waltz into your home, take the time to hack your device, and then wait for audio capture. Instead, if we want to protect our privacy, we should remember that TVs are now equipped with functionality that can be intrusive, and we need to take the time to lock down settings and preferences to keep data collection to a minimum.
Also: Your TV may be tracking your viewing data – here’s how to stop it (beyond disabling ACR)
“The capabilities are there to be used as a listening device,” Gamers Nexus says. “By whom is another question.”
How to stop your TV from tracking you
As Gamers Nexus said, unplugging your TV might not be enough to stop inherent spying features. Instead, follow these tips to lock down your data and reduce tracking practices:
- Settings: When you set up your new TV or want to check the status of your existing model, go into settings and look for options including privacy, security, and advertising. Take a look at Settings > Privacy, Connections, Terms of Service, Personalized Experiences, and similar tabs to disable any feature that involves collecting, storing, or sharing your information.
- Microphone use: Microphones are embedded in our smart TVs for voice assistants and voice recognition features, and if you don’t use them, consider disabling the microphone entirely. This can often be found under general settings.
- ACR: Disable ACR whenever possible. The option is hidden in different places depending on your TV’s model, but we have a guide for stopping ACR data collection that covers LG, Samsung, Sony, Hisense, and TCL/Roku.
- Data sharing: Pay particular attention to any setting in your TV’s menu that involves personalized experiences, third-party data sharing — for diagnostic use or otherwise — and personalized ads. Disable any feature that allows your TV’s manufacturer to share your information with its partners.
- Apps: Don’t download any app you don’t need. Earlier this year, LG revealed plans to suspend apps operating as secret proxies, and we simply don’t know what code or functionality could be hidden in seemingly innocent TV apps. If you don’t need it, don’t install it.
ZDNET reached out to LG, which said the claims made in the researchers’ video are inaccurate. While noting that ACR is an opt-in feature that doesn’t use data for advertising purposes without user consent, the company also said: “LG TVs process voice data only when the voice button on the remote control is pressed and held, or when a wake word such as ‘Hi LG’ is recognized after the user has activated the Far-Field voice recognition feature.”
“To provide smart TV functionalities, LG TVs feature the ability to scan for and connect to nearby devices on the same network,” LG added. “This is a standard function commonly provided by smart TVs and smart home devices.”
